Oracle EBS Vulnerability Probed Days After Patch
Threat actors began scanning enterprise networks almost immediately after software maintainers published defensive fixes. Specifically, cybersecurity analysts detected exploratory probes targeting the severe Oracle EBS vulnerability on research honeypots. The security firm Defused recorded these hostile inquiries on October 27. Notably, these reconnaissance attempts emerged a mere seven days after Oracle issued its scheduled update. Consequently, security teams must accelerate system patching before full exploitation escalates across corporate environments.
Critical SQL Injection in Application Framework
The intrusion campaign targets CVE-2026-101767, which carries a critical CVSS rating of 9.8. Specifically, the flaw resides inside the core Oracle Application Object Library framework. The defect affects E-Business Suite versions spanning 12.2.3 through 12.2.15. To execute an attack, an adversary requires only network access over standard HTTP or HTTPS channels. Furthermore, the vulnerability demands neither user interaction nor authenticated credentials.
Researchers at Horizon3.ai discovered the security flaw and disclosed the technical exploit chain publicly. The vulnerability stems from an unauthenticated SQL injection in the Thin Client Framework servlet at /OA_HTML/AppsTCFServer. Default system configurations heighten this danger considerably because native URL filters permit open requests to the endpoint. Consequently, a crafted request allows attackers to execute arbitrary database commands with administrative APPS privileges.
Escalation Pathways and Corporate Exposure
Once database access succeeds, adversaries can execute operating system commands under the EBS application account. Through administrative database channels, attackers can access sensitive financial ledgers, payroll records, human resource files, and procurement archives. However, operating system privileges remain confined to the specific EBS service account.
According to an investigative report published by Defused, current observed activity remains strictly exploratory. Researchers have not confirmed operational compromise within live enterprise networks yet. Instead, honeypots indicate that adversaries are systematically locating exposed corporate installations. Therefore, these preliminary probes signal imminent weaponization rather than verified data theft.
Historical Precedent and Urgent Mitigation Measures
Horizon3.ai originally reported the vulnerability to Oracle on July 24. Subsequently, Oracle addressed the defect within its massive October Critical Patch Update. That unified release patched 194 total flaws across the suite, including 31 unauthenticated remote vulnerabilities. Corporate interest in exploiting EBS remains elevated, as evidenced by a 2025 breach that compromised supply-chain giant Michelin.
Administrators operating unpatched deployments must apply compensating controls immediately. Security teams should remove /OA_HTML/AppsTCFServer from allowed URL lists and restrict access to trusted networks. Furthermore, engineers must inspect traffic for POST requests to GanttDataServer and anomalous files within temporary directories. Ultimately, applying official vendor updates remains the only definitive defense against persistent enterprise intrusion.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
